URL:

https://connectfansus.lt.acemlna.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZwYWdhbWVudG8ub2dydXBvaW1wdWxzZS5jb20lMkZMR2tO&sig=HEz1yAE3AnqPuE1E5x2B85npNv9apJBriEfD1oZFcDeu&iat=1709127434&a=%7C%7C801579481%7C%7C&account=connectfansus.activehosted.com&email=RWpwN3ZZGJSMM3y4VAS9azF01WqVKzNpZVcpdrf6UFhM8Ew%3D%3AQ7K7ypPXKwbvTegOw5FKpT%2BzdPVOoq5N&s=be6ec883b9846ec07ebc65a9eb80278b&i=3875A4218A1A15249

Full analysis: https://app.any.run/tasks/9198a973-6d7a-4e02-bf62-feb70b947127
Verdict: Malicious activity
Analysis date: February 29, 2024, 06:20:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

6B8899BF1F12BAF0A84AAF64AD972255

SHA1:

AA23C97AABF8E82B762492BE1E29F7866DED1C2B

SHA256:

35A46AD9C1FD11AA3766432F293BC4769D24F2B2CCF935CE2638E877AD10B1DA

SSDEEP:

12:2d3WUglSm0mMPCenvF9CDJrZh21hT0k/RF6:2dTgY/CenbSJrZh+iEF6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msdt.exe (PID: 956)

    • Reads settings of System Certificates

      • msdt.exe (PID: 956)

    • Reads the Internet Settings

      • sdiagnhost.exe (PID: 3164)

    • Process uses IPCONFIG to discover network configuration

      • sdiagnhost.exe (PID: 3164)

    • Uses ROUTE.EXE to obtain the routing table information

      • sdiagnhost.exe (PID: 3164)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3240)

    • Reads security settings of Internet Explorer

      • msdt.exe (PID: 956)
      • sdiagnhost.exe (PID: 3164)

    • Reads the software policy settings

      • msdt.exe (PID: 956)

    • Drops the executable file immediately after the start

      • msdt.exe (PID: 956)

    • Create files in a temporary directory

      • msdt.exe (PID: 956)
      • sdiagnhost.exe (PID: 3164)
      • makecab.exe (PID: 2724)

    • Creates files or folders in the user directory

      • msdt.exe (PID: 956)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
7
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe msdt.exe no specs sdiagnhost.exe no specs ipconfig.exe no specs route.exe no specs makecab.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
956 -modal 1114548 -skip TRUE -path C:\Windows\diagnostics\system\networking -af C:\Users\admin\AppData\Local\Temp\NDF2C6A.tmp -ep NetworkDiagnosticsWebC:\Windows\System32\msdt.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Diagnostics Troubleshooting Wizard
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msdt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1768"C:\Windows\system32\ROUTE.EXE" printC:\Windows\System32\ROUTE.EXE—sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Route Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\route.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
2724"C:\Windows\system32\makecab.exe" /f NetworkConfiguration.ddfC:\Windows\System32\makecab.exe—sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Cabinet Maker
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\makecab.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2832"C:\Windows\system32\ipconfig.exe" /allC:\Windows\System32\ipconfig.exe—sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
3164C:\Windows\System32\sdiagnhost.exe -EmbeddingC:\Windows\System32\sdiagnhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Scripted Diagnostics Native Host
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sdiagnhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
3240"C:\Program Files\Internet Explorer\iexplore.exe" "https://connectfansus.lt.acemlna.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZwYWdhbWVudG8ub2dydXBvaW1wdWxzZS5jb20lMkZMR2tO&sig=HEz1yAE3AnqPuE1E5x2B85npNv9apJBriEfD1oZFcDeu&iat=1709127434&a=%7C%7C801579481%7C%7C&account=connectfansus.activehosted.com&email=RWpwN3ZZGJSMM3y4VAS9azF01WqVKzNpZVcpdrf6UFhM8Ew%3D%3AQ7K7ypPXKwbvTegOw5FKpT%2BzdPVOoq5N&s=be6ec883b9846ec07ebc65a9eb80278b&i=3875A4218A1A15249"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3916"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3240 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
28 753
Read events
28 589
Write events
120
Delete events
44

Modification events

(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31091415
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31091415
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
2
Suspicious files
58
Text files
56
Unknown types
16

Dropped files

PID
Process
Filename
Type
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:45D25CDF11FF2D31AFA92052883A6B28
SHA256:CBD3AF4EDA1BB97E5791B3EB7F3FD250EC2970CB6A6054F7276787B9A59D6949
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:B40C4FD2DD24A9A07FF85824E7CD5D4F
SHA256:FE5838C562EDD5E79D5D56D607B6DE565D7FCC96F3FADAD0D745B5406094EAFB
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62der
MD5:2621DD5D67B97112B1B8F0311C22CBE0
SHA256:A5EF483D5F52F45371C362092E58B3D299A3233907DC0296476E9F9860C33241
3916iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabFADC.tmpcompressed
MD5:753DF6889FD7410A2E9FE333DA83A429
SHA256:B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78
3916iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabFADA.tmpcompressed
MD5:753DF6889FD7410A2E9FE333DA83A429
SHA256:B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751der
MD5:822467B728B7A66B081C91795373789A
SHA256:AF2343382B88335EEA72251AD84949E244FF54B6995063E24459A7216E9576B9
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:B279EC0E4DCAA5AB539E299F862BE735
SHA256:D8155BB8F3E6CD88BE401C92E12E948D0C8AFCA9F561F49F101E631E4AC52236
3240iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].pngimage
MD5:5BA79DFCB82BD07122F7416B49A9D0F6
SHA256:235ED3A770C2E0F1F321CB4F30D2FEDD1896FEAED02242CF16DC7CAD2F51ED71
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894binary
MD5:362FF81AFECE91E1483A833D54D09616
SHA256:ED4CA8E8C0C636590A03B8EF669954DB3A20E7971D0AF83B24A97757DF001225
3916iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarFADB.tmpcat
MD5:DD73CEAD4B93366CF3465C8CD32E2796
SHA256:A6752B7851B591550E4625B832A393AABCC428DE18D83E8593CD540F7D7CAE22
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
50
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3916
iexplore.exe
GET
304
23.32.238.201:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f78d505714a595e3
unknown
—
—
unknown
3916
iexplore.exe
GET
304
23.32.238.226:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?545e1839169dd0e6
unknown
—
—
unknown
3916
iexplore.exe
GET
200
18.239.15.14:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
unknown
binary
2.02 Kb
unknown
3916
iexplore.exe
GET
200
18.65.41.80:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
unknown
binary
1.49 Kb
unknown
3916
iexplore.exe
GET
200
18.65.41.80:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkzUBtJnwJkc3SmanzgxeYU%3D
unknown
binary
1.37 Kb
unknown
3916
iexplore.exe
GET
200
18.239.62.218:80
http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEARXBmF0edQaVZNxqATVgMU%3D
unknown
binary
471 b
unknown
3916
iexplore.exe
GET
200
23.32.238.226:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?a08f35fbea17b647
unknown
compressed
67.5 Kb
unknown
3916
iexplore.exe
GET
200
23.32.238.201:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?fa310b6d6a2541a6
unknown
compressed
67.5 Kb
unknown
3916
iexplore.exe
GET
200
23.32.238.226:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?86b4b67e50f1d6bf
unknown
compressed
67.5 Kb
unknown
3916
iexplore.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3916
iexplore.exe
54.80.179.254:443
connectfansus.lt.acemlna.com
AMAZON-AES
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3916
iexplore.exe
23.32.238.201:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3916
iexplore.exe
23.32.238.226:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3916
iexplore.exe
18.239.15.14:80
o.ss2.us
—
US
unknown
3916
iexplore.exe
18.65.41.80:80
ocsp.rootg2.amazontrust.com
AMAZON-02
US
unknown
3916
iexplore.exe
18.239.62.218:80
ocsp.r2m03.amazontrust.com
—
US
unknown
3916
iexplore.exe
34.76.180.229:443
pagamento.ogrupoimpulse.com
GOOGLE-CLOUD-PLATFORM
BE
unknown

DNS requests

Domain
IP
Reputation
connectfansus.lt.acemlna.com
  • 54.80.179.254
  • 44.218.130.238
  • 44.218.248.61
unknown
ctldl.windowsupdate.com
  • 23.32.238.226
  • 23.32.238.178
  • 23.32.238.242
  • 23.32.238.201
  • 23.32.238.225
  • 23.32.238.232
whitelisted
o.ss2.us
  • 18.239.15.14
  • 18.239.15.192
  • 18.239.15.186
  • 18.239.15.174
whitelisted
ocsp.rootg2.amazontrust.com
  • 18.65.41.80
whitelisted
ocsp.rootca1.amazontrust.com
  • 18.65.41.80
shared
ocsp.r2m03.amazontrust.com
  • 18.239.62.218
unknown
pagamento.ogrupoimpulse.com
  • 34.76.180.229
unknown
x1.c.lencr.org
  • 69.192.161.44
whitelisted
virtualaassistant.com
  • 76.76.21.21
unknown
api.bing.com
  • 13.107.5.80
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://connectfansus.lt.acemlna.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZwYWdhbWVudG8ub2dydXBvaW1wdWxzZS5jb20lMkZMR2tO&sig=HEz1yAE3AnqPuE1E5x2B85npNv9apJBriEfD1oZFcDeu&iat=1709127434&a=%7C%7C801579481%7C%7C&account=connectfansus.activehosted.com&email=RWpwN3ZZGJSMM3y4VAS9azF01WqVKzNpZVcpdrf6UFhM8Ew%3D%3AQ7K7ypPXKwbvTegOw5FKpT%2BzdPVOoq5N&s=be6ec883b9846ec07ebc65a9eb80278b&i=3875A4218A1A15249